Re: email as a bona fide git transport

Konstantin Ryabitsev
2019-10-18T18:00:31Z

[-- Attachment #1: Type: text/plain, Size: 1517 bytes --]

On Fri, Oct 18, 2019 at 12:11:22PM -0400, Santiago Torres Arias wrote:
>> It's smaller, but it's not a one-liner. Here's a comparison using
>> ED25519
>> keys of the same length:
>>
>> minisign:
>>
>> RWQ4kF9UdFgeSt3LqnS3WnrLlx2EnuIFW7euw5JnLUHY/79ipftmj7A2ug7FiR2WmnFNoSacWr7llBuyInVmRL/VRovj1LFtvA0=
>>
>> pgp:
>>
>> -----BEGIN PGP SIGNATURE-----
>>
>> iHUEARYIAB0WIQR2vl2yUnHhSB5njDW2xBzjVmSZbAUCXaniFAAKCRC2xBzjVmSZ
>> bHA5AP46sSPFJfL2tbXwswvj0v2DjLAQ9doxl9bfj9iPZu+3qwEAw5qAMbjw9teL
>> L7+NbJ0WVniDWTgt+5ruQ2V9vyfYxAc=
>> =B/St
>
>Yeah, the discrepancy mostly comes from pgp embedding a timestamp and a
>longer keyid (+a full keyid fingerprint in pgp 2.1+). Minisign keyids
>are 8 random bytes, apparently.
>
>It doesn't seem like an amazing win in terms of succintness, imvho...

There isn't, but ED25519 subkeys are still very rare among developers.
Many have 4096-bit RSA subkeys, and you can imagine how large the sigs
from those are.

I want to underline that my use of minisign was specifically for patches
sent via email, without the intent of preserving them in git history
(which is why in my proposal they are put under the `---` cutoff). Git
itself would continue to use PGP signing.

(This also means that we don't necessarily need to make this a native
part of git -- it can be accomplished by a combination of wrappers,
git-format-patch parameters, and a pre-applypatch hook. However, the
likelihood of adoption in this case would be very low.)

-K

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]